CVE-2024-55591

What it actually does

This is a critical authentication-bypass vulnerability in the FortiOS and FortiProxy administrative interface. A remote, unauthenticated attacker can send crafted requests to the Node.js WebSocket component and reach an alternate administrative channel without valid credentials. Successful exploitation grants super-admin privileges, allowing full configuration control, creation of administrator accounts, policy changes, VPN/user manipulation, traffic interception, and potential deployment of persistence mechanisms. The affected versions are FortiOS 7.0.0 through 7.0.16, FortiProxy 7.0.0 through 7.0.19, and FortiProxy 7.2.0 through 7.2.12.

Why it matters to the business

Compromise of an internet-facing Fortinet firewall or proxy can give attackers control over a critical security boundary. This can lead to network intrusion, VPN abuse, credential exposure, traffic redirection, disabling of protections, data theft, and ransomware deployment. The vulnerability is listed in CISA KEV, has very high exploitation probability, is confirmed exploited in the wild, and has been associated with ransomware activity including Qilin, BianLian, RansomExx, DragonForce, and Play campaigns. Organizations that have not remediated since the 2025-01-21 KEV due date should treat exposed devices as high-risk and potentially compromised.

How an attack unfolds

An attacker first identifies an exposed FortiOS or FortiProxy administrative service running a vulnerable 7.0 or 7.2 release. They then send crafted WebSocket requests to the Node.js administrative channel in a way that bypasses normal authentication checks. Once the alternate path is accepted, the attacker obtains super-admin level access through the management interface or JavaScript console channel. From there, they can create new administrator accounts, modify existing access controls, alter firewall or proxy policy, enable or change VPN access, export configuration data, and establish persistence. In ransomware-driven intrusions, this access may be used to enter the internal network, stage tools, disable protections, exfiltrate data, and deploy ransomware across reachable systems.

How to fix it

Upgrade immediately. FortiOS 7.0 deployments should be upgraded to FortiOS 7.0.17 or later. FortiProxy 7.0 deployments should be upgraded to FortiProxy 7.0.20 or later. FortiProxy 7.2 deployments should be upgraded to FortiProxy 7.2.13 or later. If immediate upgrade is not possible, remove public access to administrative interfaces, restrict management access to trusted IP ranges only, enforce administrative trusted hosts, place management behind a VPN or dedicated management network, and use local-in policies to block untrusted access. Review all administrator accounts, API users, VPN users, firewall policies, and recent configuration changes after patching because exploitation grants full administrative control.

How to confirm the fix worked

Confirm the running firmware version is outside the affected ranges: FortiOS should not be 7.0.0 through 7.0.16, FortiProxy should not be 7.0.0 through 7.0.19 or 7.2.0 through 7.2.12. Verify that the administrative interface is not reachable from the public internet unless explicitly required and tightly restricted. Confirm trusted-host restrictions or equivalent management ACLs are applied for every administrator account. Review the configuration revision history for unexpected changes. Validate that no unauthorized administrator, API, local user, or VPN account exists. Review system event logs for WebSocket or jsconsole administrative logins, especially from unfamiliar source IPs, before and after the upgrade.

Typical attack path

1. Scan the internet or target address ranges for exposed FortiOS or FortiProxy administrative interfaces.
2. Fingerprint the service version or behavior to identify likely vulnerable releases.
3. Send crafted HTTP/WebSocket requests to the Node.js WebSocket administrative module.
4. Bypass authentication through the alternate administrative channel.
5. Obtain super-admin access, often visible in logs as JavaScript console or WebSocket-based administrative activity.
6. Create or modify administrator accounts, VPN users, firewall policies, routes, or proxy configuration.
7. Use the appliance as a foothold for internal reconnaissance, credential collection, traffic interception, or VPN access.
8. Deploy additional tooling, exfiltrate data, or support ransomware operations.

How to detect it

Review FortiGate/FortiProxy system event logs, administrative audit logs, configuration revision history, VPN logs, and upstream web/proxy logs for signs of unauthorized WebSocket or JavaScript console administrative access. Prioritize events showing successful admin logins from unknown IP addresses, ui or method values of jsconsole, new administrator creation, privilege escalation to super-admin, unexpected configuration changes, new VPN users, changed trusted hosts, altered firewall policies, or disabled logging/security features. Check whether management access was exposed to the internet during the vulnerable period. Correlate suspicious admin activity with external source IPs, WebSocket upgrade requests, and subsequent internal VPN or management activity. Because exploitation has been tied to ransomware campaigns, also hunt for post-compromise behaviors such as new remote access paths, reconnaissance, credential access, large outbound transfers, and security tool tampering.

• ui="jsconsole"
• method="jsconsole"
• logged in successfully from jsconsole
• Administrator admin logged in successfully from jsconsole
• logdesc="Admin login successful"
• msg="Admin login successful"
• /ws/cli/open
• GET /ws/cli/open
• Upgrade: websocket
• Connection: Upgrade
• config system admin
• set accprofile super_admin
• logdesc="Object attribute configured"
• logdesc="Admin user added"
• msg="Add administrator"
• msg="Edit administrator"
• config vpn ssl web portal
• config vpn ssl settings

What your security team should do

• Treat internet-exposed vulnerable FortiOS and FortiProxy appliances as urgent incident-response candidates, not only patching candidates.
• Upgrade affected systems to FortiOS 7.0.17 or later, FortiProxy 7.0.20 or later, or FortiProxy 7.2.13 or later as applicable.
• Immediately remove public administrative access or restrict it to trusted management IP addresses.
• Hunt for successful administrative logins using jsconsole, WebSocket CLI, or unfamiliar source IP addresses.
• Audit all administrator accounts, API tokens, VPN users, trusted hosts, firewall policies, routes, and configuration revisions for unauthorized changes.
• Rotate credentials and secrets stored on or used by the appliance if compromise is suspected.
• Preserve logs and configuration backups before making major changes if incident response or forensic investigation may be required.
• Monitor for ransomware follow-on activity, including unusual VPN logins, internal scanning, bulk data transfer, disabled security controls, and suspicious remote administration tools.